feat: list topology sub-pages in the sidebar

[Atom-oh]

Summary

• The resource/infra layout graph (/topology/infra) and service map (/topology/services) were only reachable via small buttons inside /topology; the sidebar had a single flat Topology link, so users could not find the resource graph.
• FIXED entries accept optional children; Topology now renders as a collapsible group (link + chevron + instance-scoped panel, same pattern as inventory groups) with Request flow / Infra layout / Service map. It auto-opens on any /topology* path; the header stays active on sub-pages without a menu entry (e.g. /topology/resource/[id]).
• New i18n keys nav.topologyFlow|Infra|Services in ko/en/zh/ja. CHANGELOG EN/KO.

Test plan

• npx vitest run (web) — 352 files / 5371 tests passed; new source-contract tests in Sidebar.test.tsx
• npx tsc --noEmit -p . — no errors outside pre-existing *.test.ts(x) noise
• After dev deploy: sidebar shows the three sub-items and opens on /topology/infra

🤖 Generated with Claude Code

[github-actions]

🤖 AI Code Review (two independent reviewers)

_Reviewer responses: codex/ALL claude/ALL _

Status: PASSED — No blocking issues found

Chair Review — PR #146: feat: list topology sub-pages in the sidebar

1. Summary

This PR adds a collapsible Topology group to the sidebar (Request flow / Infra layout / Service map), registers the two new sub-routes in MobileTopBar's title map, adds the three nav.* keys to all four locales, adds lockstep tests, and records the change in both changelog sections. Both panels independently found no CRITICAL/MAJOR issues; the chair verified the load-bearing claims against BASE plus the patch (icon imports at web/components/shell/Sidebar.tsx:10,13, existing target routes web/app/topology/{infra,services}/page.tsx, the four-locale keyset-parity guard at web/lib/i18n.test.ts:34-40, the translate export and sidebar.expand/sidebar.collapse keys at web/lib/i18n.ts:89-90,480, and MobileTopBar.tsx:46-50 longest-prefix resolution) and confirms the change is sound.

2. Issues per lens

L2 — Code correctness

No CRITICAL/MAJOR. Both models agree the navigation, active-state, seeding and persistence logic is correct; codex noted its runtime test execution was blocked by a sandbox limit (an environment caveat, not a code finding), while claude's static trace covered the same ground and I re-verified the pivotal facts (icons already imported, routes exist, i18n parity preserved, underPath safe for prefix matching).

• MINOR (claude only; verified intended): manual collapse of the Topology panel is undone by the next navigation under /topology, and clicking the header always re-expands. This mirrors the pre-existing inventory-group behavior and matches the changelog's "opens automatically on any topology page" — intentional, noted for the record.
• MINOR (claude only; confirmed): /topology is reachable from both the group header and the "Request flow" child; with the panel open on /topology, the header is deliberately un-highlighted while the child is active, and a screen reader sees two links to the same href with different names. A defensible UX choice, not a bug.
• MINOR (claude only; confirmed): the new tests assert literal source strings ('item.children ? renderFixedGroup(item)', the headerActive boolean expression) and the FIXED slice heuristic now depends on the nested array closing as ] },. Formatting-only changes can break or silently vacate these assertions. Consider render-level assertions in a follow-up.

L3 — Security / AWS mutation safety

No findings — both models agree. The patch is client-side navigation metadata and locale strings only: no new API surface, no fetch/SDK/IAM/Terraform change, no secrets. The ADR-005 mutation freeze is untouched; the pages made more discoverable (/api/graph, /api/inventory/* readers) were already routable and remain read-only and scope-checked, so no authorization boundary widens.

L4 — Observability / data-integration correctness

No findings — both models agree. No Steampipe SQL, compliance checks, collectors or AgentCore diagnosis logic is touched. The one data-adjacent behavior — MobileTopBar route→label resolution — was verified: longest-prefix sort correctly resolves /topology/infra and /topology/services to their own titles while /topology/resource/<id> still falls back to "Topology", consistent with the sidebar's header-active rule. The in-page coverage/ownership caveats (GraphCollectionStatus/GraphReadError) are not bypassed.

L5 — Docs / ADR consistency

No CRITICAL/MAJOR. Changelog placement and convention verified: one bullet per feature under both ## [Unreleased] → ### Added sections (the "First release of the v2 line" context in the second hunk is git's heading heuristic, not the real section), no PR/round numbers, EN/KO 1:1 — the codex panel concurs the entries match the implemented behavior. web/app/CLAUDE.md's "register in Sidebar + add nav key to i18n" rule is satisfied.

• MINOR (claude only; chair-verified against docs-site/docs/getting-started/navigation.md:22): the published user-guide navigation page still lists the fixed menu as flat, with no mention of the Topology chevron or its three sub-entries; the same paragraph exists in the en/zh/ja locale copies. Since docs-site retains locale parity and the changelog markets this as user-visible, worth updating in this PR or a fast follow-up.
• MINOR (claude only): docs-site/docs/resources/topology.md still describes the in-page selectors as the route to the infra/service views — literally still true, so optional, but it should accompany the navigation-page edit if made.

3. Suggestions

1. Update the four locale copies of docs-site/.../getting-started/navigation.md (and optionally resources/topology.md) to describe the new collapsible Topology entry.
2. Consider replacing the literal-source-string test assertions with render-level tests (@testing-library/react) so formatting changes don't break or vacate them.
3. Optionally revisit whether the group header should remain visually active alongside the "Request flow" child on /topology to avoid the "clicked entry looks inactive" effect.

4. Verdict

No CRITICAL or MAJOR findings from either panel or from chair verification; all MINOR items are non-blocking polish. Panels agree across all four lenses, and the points of agreement were independently re-verified against the resulting code rather than taken on trust. The image manifest lists no images, no deletions and no unavailable/omitted entries, and both panel cells declared coverage not required.

IMAGE_COVERAGE: NOT_REQUIRED

---

Triggered by commit 8aa316c0e30f43efdb05446760046dfd24b1a10b · workflow: .github/workflows/pr-review.yml